purmp[.]fun

Analysis of purmp.fun indicates a deliberate brand‑impersonation operation targeting the Blast brand. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and subsequently resolved to the Cloudflare‑hosted address 172.67.132.56, which is associated with ASN 13335 (Cloudflare, Inc.) located in the United States. The site presented a page title of “Pump” and is classified as a crypto‑scam, suggesting the payload may involve fraudulent cryptocurrency transactions or wallet theft. No TLS certificate is associated with the domain, confirming the absence of HTTPS encryption.

The infrastructure uses Cloudflare’s authoritative nameservers ashley.ns.cloudflare.com and jasper.ns.cloudflare.com, a common pattern for fast‑flux or abuse‑hosting services. Gridinsoft’s trust score of 0 / 100 further indicates a high‑confidence malicious assessment. VirusTotal scans returned 10 positive detections out of 93 vendors, and the domain appears on one external security blocklist, substantiating its malicious nature. PhishDestroy has already taken the domain offline, and current HTTP status is unavailable.

While the exact malicious page content has not been captured, the convergence of brand impersonation, crypto‑scam labeling, low trust score, and multiple vendor detections provides strong evidence of a threat. Defenders should immediately block purmp.fun at the DNS and proxy layers, add the associated IP 172.67.132.56 to network‑level blocklists, and monitor Cloudflare‑owned address ranges for re‑use of similar domains. Ongoing watch‑lists should be updated with the registrar and nameserver information to detect future registrations that may attempt to replicate this infrastructure. Incident response teams should also query threat‑intel platforms for any emerging indicators related to the Blast brand impersonation campaign, ensuring rapid containment should the domain become active again.